ATTACHMENT_A_-_ISS_-_Enterprise_Security_Standards_-_External_Data_Hosting_Rev3.pdf

This is an Enterprise Security Standards policy document issued by Orange County Government Board of County Commissioners (OCGBCC) in Florida, establishing mandatory external data hosting requirements for all vendors, networks, systems, and applications that transmit, process, store, or handle electronic data on behalf of the county. The policy establishes comprehensive security standards governing data input and processing, storage and handling, transmission, and disposal procedures. Specifically, vendors must ensure that hosted applications do not have access to sensitive information including Social Security numbers, bank account information, Active Directory usernames, or county internal/DMZ networks. All sensitive data—including usernames, passwords, names, addresses, phone numbers, email addresses, birthdates, federal/state/local document numbers, account numbers, and HIPAA or PCI information—must be encrypted at the field-level both at rest and in transit within encrypted tunnels. The policy also requires that vendors maintain security best practices in their web hosting environments and applications, with compliance verified through yearly penetration testing conducted by Orange County ISS personnel or through results from external audits by reputable third-party security firms.

Data disposal procedures must follow strict protocols including sanitization through data overwriting, physical destruction of media, or purging using degaussing technology to render data unrecoverable. The policy, most recently revised in October 2017, specifically references Florida Statute 119.071 regarding Social Security information handling and establishes definitions for key terms including bank information, electronic media, sanitization, and physical destruction. This document serves as a binding security standard for any vendor seeking to contract with Orange County for services involving external data hosting or processing of county information.